See it in action

Watch Ryft work.

The Ryft 1.0 feature set, plus four real workflows against a live API — no voiceover, no edits, just the product doing the work on your machine.

New in 1.0

What's new in Ryft 1.0

Authenticated testing, end to end — a platform-wide login context, a guided scanner, and first-class GraphQL, with the tools that drive it all.

Ryft Global Session — a login recipe (POST credentials, extract the token by JSON path, inject as Bearer) that makes every tool test as an authenticated user — **Global Session.** Set your login once — every tool tests as a logged-in user. Scope-gated tokens, auto-reauth when they expire.

Ryft's authenticated scanner — a guided four-step wizard (Target, Identity, Checks, Review and scan) with selectable source tiles — **Authenticated scanner.** A guided 4-step wizard — Target, Identity, Checks, Review — that won't let you fire a half-configured scan.

Ryft Target Intelligence — a live map of endpoints, inferred roles, auth and parameters projected from traffic, specs and JavaScript — **Target Intelligence.** A live map of every endpoint, role and parameter — projected from traffic, specs and decoded JavaScript.

Ryft GraphQL — introspect the schema, explore types and operations, then run an audit — **GraphQL.** Introspect the schema, then scan its operations directly — first-class GraphQL targets.

Ryft Collections and Environments — collapsible request cards and named variable sets with masked secrets — **Collections & Environments.** Organize requests into collapsible cards; drive them with named variable sets and masked secrets.

Ryft Proxy — intercept and capture in-scope traffic, scope-gated, with Cruise Control intensities — **Proxy.** Intercept and capture in-scope traffic, scope-gated — with Cruise Control to auto-scan as you browse.

01 · Intelligence

A live map of the whole attack surface

Ryft projects every endpoint, role and parameter from traffic, specs and decoded JavaScript — source-tagged, because JS claims are hypotheses, not findings.

Ryft — Recon

02 · Reconstruction

Rebuild an API spec from JavaScript

No OpenAPI doc? Point Ryft at a site's JS bundle and it fetches, de-obfuscates and maps the API out of the client code — a complete, testable spec in one click.

Ryft — Reconstruct Spec

03 · Scanning

An honest OWASP API Top 10 scan

Confirm you're authorized, start the scan, and watch findings land — oracle-backed checks with firm-vs-tentative confidence, so what you see is real, not false-positive noise.

Ryft — Scanner

04 · Cruise Control

Scan while you browse

Turn on the proxy, pick an intensity, and just click around the app. Ryft auto-scans every new in-scope request in the background — non-destructive by default — while a live HUD counts what it's seen, probed and found.

Ryft — Cruise Control

Ready to find what others miss?

Everything you just watched runs on your machine — your test traffic, captured data, and findings never leave it. No account, no analytics on your testing; the only network call is an anonymous version check on launch.

Get Ryft See all features